@codedrifters/configulator 0.0.402 → 0.0.404

package/lib/index.mjs

@@ -4326,6 +4326,35 @@ function buildBaseBundle(paths = DEFAULT_AGENT_PATHS) {
           "schema and consumer example. `status:deferred` is a valid",
           "override value reserved for this exact use case.",
           "",
+          "### The `status:deferred` invariant",
+          "",
+          "**No agent, procedure, or sweep ever removes `status:deferred`.",
+          "Only a human promotes a deferred issue.**",
+          "",
+          "`status:deferred` records a deliberate human decision to park",
+          "work. Automation may read it, count it, and log it \u2014 but the",
+          "label is cleared exclusively by a human (or by a scheduled task",
+          "a human configured for that purpose). Concretely:",
+          "",
+          "- **Unblock sweeps skip it.** Both `check-blocked.sh unblock`",
+          "  and `unblock-dependents.sh` leave a `status:deferred` +",
+          "  `status:blocked` issue blocked when its dependencies close,",
+          "  emitting a `SKIP_DEFERRED #<n>` line instead of flipping to",
+          "  `status:ready`. Dependency resolution is not a promotion",
+          "  signal for parked work.",
+          "- **Dispatch scans exclude it.** `check-blocked.sh eligible`",
+          "  drops any issue carrying `status:deferred`, so a stray",
+          "  `status:ready` + `status:deferred` pairing never reaches a",
+          "  worker.",
+          "- **No sweep writes it either.** Automation adds",
+          "  `status:deferred` only at filing time via the configured",
+          "  `issueDefaults` \u2014 never as a runtime triage decision.",
+          "",
+          "An issue that legitimately needs to leave the parked backlog is",
+          "promoted by a human removing `status:deferred` and setting the",
+          "appropriate base status. Any automation that removes the label",
+          "is a bug.",
+          "",
           "### Blocking Rules",
           "",
           "Two rules force `status:blocked` \u2014 both are non-negotiable:",
@@ -5527,6 +5556,409 @@ function buildBcmWriterBundle(paths = DEFAULT_AGENT_PATHS, issueDefaults = DEFAU
 }
 var bcmWriterBundle = buildBcmWriterBundle();
 
+// src/turbo/turbo-repo.ts
+import {
+  Component as Component2,
+  FileBase,
+  JsonFile,
+  SampleDir,
+  SampleFile
+} from "projen/lib";
+import { JobPermission } from "projen/lib/github/workflows-model";
+
+// src/turbo/turbo-repo-task.ts
+import { Component } from "projen/lib";
+var TurboRepoTask = class extends Component {
+  constructor(project, options) {
+    super(project);
+    this.project = project;
+    this.name = options.name;
+    this.dependsOn = options.dependsOn ?? [];
+    this.env = options.env ?? [];
+    this.passThroughEnv = options.passThroughEnv ?? [];
+    this.outputs = options.outputs ?? [];
+    this.cache = options.cache ?? true;
+    this.inputs = [
+      ...options.inputs ?? [],
+      // rerun if projen config changes
+      ".projen/**",
+      // ignore mac files
+      "!.DS_Store",
+      "!**/.DS_Store"
+    ];
+    this.outputLogs = options.outputLogs ?? "new-only";
+    this.persistent = options.persistent ?? false;
+    this.interactive = options.interactive ?? false;
+    this.isActive = true;
+  }
+  taskConfig() {
+    return {
+      dependsOn: this.dependsOn,
+      env: this.env,
+      passThroughEnv: this.passThroughEnv,
+      outputs: this.outputs,
+      cache: this.cache,
+      inputs: this.inputs,
+      outputLogs: this.outputLogs,
+      persistent: this.persistent,
+      interactive: this.interactive
+    };
+  }
+};
+
+// src/turbo/turbo-repo.ts
+var ROOT_TURBO_TASK_NAME = "turbo:build";
+var ROOT_CI_TASK_NAME = "build:all";
+var _TurboRepo = class _TurboRepo extends Component2 {
+  constructor(project, options = {}) {
+    super(project);
+    this.project = project;
+    /**
+     * Sub-Tasks to run
+     */
+    this.tasks = [];
+    this.turboVersion = options.turboVersion ?? "catalog:";
+    this.isRootProject = project === project.root;
+    if (this.isRootProject) {
+      project.addDevDeps(`turbo@${this.turboVersion}`);
+    }
+    project.gitignore.addPatterns("/.turbo");
+    project.npmignore?.addPatterns("/.turbo/");
+    this.extends = options.extends ?? (this.isRootProject ? [] : ["//"]);
+    this.globalDependencies = options.globalDependencies ?? [];
+    this.globalEnv = options.globalEnv ?? [];
+    this.globalPassThroughEnv = options.globalPassThroughEnv ?? [];
+    this.ui = options.ui ?? "stream";
+    this.dangerouslyDisablePackageManagerCheck = options.dangerouslyDisablePackageManagerCheck ?? false;
+    this.cacheDir = options.cacheDir ?? ".turbo/cache";
+    this.daemon = options.daemon ?? true;
+    this.envMode = options.envMode ?? "strict";
+    this.runOptions = {
+      ...options.runOptions,
+      summarize: options.runOptions?.summarize ?? true,
+      concurrency: options.runOptions?.concurrency ?? 10
+    };
+    this.remoteCacheOptions = options.remoteCacheOptions;
+    this.buildAllTaskEnvVars = options.buildAllTaskEnvVars ?? {};
+    this.buildTask = new TurboRepoTask(this.project, {
+      name: ROOT_TURBO_TASK_NAME,
+      dependsOn: this.isRootProject ? [`^${ROOT_TURBO_TASK_NAME}`] : []
+    });
+    if (this.isRootProject) {
+      this.buildAllTask = this.project.tasks.addTask(ROOT_CI_TASK_NAME, {
+        description: "Root build followed by sub-project builds. Mimics the CI build process in one step."
+      });
+      this.buildAllTask.exec("turbo telemetry disable");
+      if (this.buildAllTaskEnvVars) {
+        Object.entries(this.buildAllTaskEnvVars).forEach(([name, value]) => {
+          this.addGlobalEnvVar(name, value);
+        });
+      }
+      if (!this.remoteCacheOptions) {
+        this.buildAllTask.exec(
+          `turbo ${ROOT_TURBO_TASK_NAME} ${this.renderRunArgs(false)}`
+        );
+      } else {
+        this.buildAllTask.exec(
+          `turbo ${ROOT_TURBO_TASK_NAME} ${this.renderRunArgs(true)}`,
+          {
+            condition: '[ ! -n "$CI" ]',
+            env: {
+              TURBO_ENDPOINT: `$(aws ssm get-parameter --name ${this.remoteCacheOptions.endpointParamName} --query Parameter.Value --output text --profile ${this.remoteCacheOptions.profileName})`,
+              TURBO_TOKEN: `$(aws ssm get-parameter --name ${this.remoteCacheOptions.tokenParamName} --query Parameter.Value --output text --profile ${this.remoteCacheOptions.profileName})`
+            }
+          }
+        );
+        this.buildAllTask.exec(
+          `turbo ${ROOT_TURBO_TASK_NAME} ${this.renderRunArgs(true)}`,
+          {
+            condition: '[ -n "$CI" ]',
+            env: {
+              TURBO_ENDPOINT: `$(aws ssm get-parameter --name ${this.remoteCacheOptions.endpointParamName} --query Parameter.Value --output text)`,
+              TURBO_TOKEN: `$(aws ssm get-parameter --name ${this.remoteCacheOptions.tokenParamName} --query Parameter.Value --output text)`
+            }
+          }
+        );
+      }
+    }
+    if (!this.isRootProject) {
+      this.preCompileTask = new TurboRepoTask(project, {
+        name: options.preCompileTask?.name ?? "pre-compile",
+        inputs: ["src/**"]
+      });
+      this.compileTask = new TurboRepoTask(project, {
+        name: options.compileTask?.name ?? "compile",
+        inputs: ["src/**"]
+      });
+      this.postCompileTask = new TurboRepoTask(project, {
+        name: options.postCompileTask?.name ?? "post-compile",
+        inputs: ["src/**"]
+      });
+      this.testTask = new TurboRepoTask(project, {
+        name: options.testTask?.name ?? "test"
+      });
+      this.packageTask = new TurboRepoTask(project, {
+        name: options.packageTask?.name ?? "package",
+        inputs: [".npmignore"]
+      });
+      this.tasks.push(
+        this.preCompileTask,
+        this.compileTask,
+        this.postCompileTask,
+        this.testTask,
+        this.packageTask
+      );
+    }
+  }
+  /**
+   * Static method to discovert turbo in a project.
+   */
+  static of(project) {
+    const isDefined = (c) => c instanceof _TurboRepo;
+    return project.components.find(isDefined);
+  }
+  /**
+   * Render the `turbo run` CLI flag string for the `build:all` / `reset:all`
+   * task commands from {@link runOptions}. With no `runOptions` configured the
+   * output matches the historically hard-coded flags exactly.
+   *
+   * @param remote - when `true`, also emit the remote-cache flags
+   * (`--cache=remote:rw` plus `--api` / `--token` / `--team` derived from
+   * {@link remoteCacheOptions}). The remote-cache `build:all` variant passes
+   * `true`; `reset:all` and the local `build:all` variant pass `false`.
+   */
+  renderRunArgs(remote) {
+    const run = this.runOptions;
+    const args = [];
+    if (run.summarize) {
+      args.push("--summarize");
+    }
+    args.push(`--concurrency=${run.concurrency}`);
+    if (run.force) {
+      args.push("--force");
+    }
+    if (run.noCache) {
+      args.push("--no-cache");
+    }
+    if (run.only) {
+      args.push("--only");
+    }
+    if (run.affected) {
+      args.push("--affected");
+    }
+    if (run.cacheWorkers !== void 0) {
+      args.push(`--cache-workers=${run.cacheWorkers}`);
+    }
+    if (run.continueOn !== void 0) {
+      args.push(`--continue=${run.continueOn}`);
+    }
+    if (run.frameworkInference !== void 0) {
+      args.push(`--framework-inference=${run.frameworkInference}`);
+    }
+    for (const filter of run.filter ?? []) {
+      args.push(`--filter=${filter}`);
+    }
+    if (run.outputLogs !== void 0) {
+      args.push(`--output-logs=${run.outputLogs}`);
+    }
+    if (run.logOrder !== void 0) {
+      args.push(`--log-order=${run.logOrder}`);
+    }
+    if (run.logPrefix !== void 0) {
+      args.push(`--log-prefix=${run.logPrefix}`);
+    }
+    if (run.dryRun !== void 0) {
+      args.push(`--dry-run=${run.dryRun}`);
+    }
+    const cache = run.cache ?? (remote ? "remote:rw" : void 0);
+    if (cache !== void 0) {
+      args.push(`--cache=${cache}`);
+    }
+    if (remote && this.remoteCacheOptions) {
+      args.push(
+        "--api=$TURBO_ENDPOINT",
+        "--token=$TURBO_TOKEN",
+        `--team=${this.remoteCacheOptions.teamName}`
+      );
+    }
+    if (run.additionalArgs) {
+      args.push(...run.additionalArgs);
+    }
+    return args.join(" ");
+  }
+  /**
+   * Add an env var to the global env vars for all tasks.
+   * This will also become an input for the build:all task cache at the root.
+   */
+  addGlobalEnvVar(name, value) {
+    this.buildAllTask?.env(name, value);
+    if (this.isRootProject) {
+      this.globalEnv.push(name);
+    }
+  }
+  activateBranchNameEnvVar(options) {
+    const value = '$([ -n "$GIT_BRANCH_NAME" ] && echo "$GIT_BRANCH_NAME" || git rev-parse --abbrev-ref HEAD)';
+    if (options === void 0) {
+      this.project.logger.warn(
+        "TurboRepo.activateBranchNameEnvVar() with no arguments is deprecated. It writes GIT_BRANCH_NAME to the root `globalEnv`, which forces every task in the monorepo to miss cache on every branch switch. Pass `{ tasks: [...] }` and name only the tasks that actually consume the branch (e.g. CDK synth/package) to preserve cross-branch cache hits for everything else."
+      );
+      this.addGlobalEnvVar("GIT_BRANCH_NAME", value);
+      return;
+    }
+    const knownTaskNames = this.tasks.map((task) => task.name);
+    const unknown = options.tasks.filter(
+      (name) => !knownTaskNames.includes(name)
+    );
+    if (unknown.length > 0) {
+      throw new Error(
+        `TurboRepo.activateBranchNameEnvVar: unknown task name(s) ${JSON.stringify(
+          unknown
+        )}. Known tasks on this TurboRepo: ${JSON.stringify(knownTaskNames)}.`
+      );
+    }
+    for (const name of options.tasks) {
+      const task = this.tasks.find((t) => t.name === name);
+      if (task && !task.env.includes("GIT_BRANCH_NAME")) {
+        task.env.push("GIT_BRANCH_NAME");
+      }
+    }
+  }
+  /**
+   * Paths of all generated files in the project, deduped, for use as task
+   * inputs so the compile cache invalidates when they change. Includes
+   * projen-managed `FileBase` files plus generated-once `SampleFile` /
+   * `SampleDir` — whose paths projen keeps private, so they are read defensively
+   * and skipped if that internal shape ever changes. Computed at synth time so
+   * files added after this component (e.g. a subclass's SampleFiles) are seen.
+   */
+  generatedFileInputs() {
+    const inputs = /* @__PURE__ */ new Set();
+    for (const component of this.project.components) {
+      if (component instanceof FileBase) {
+        inputs.add(component.path);
+      } else if (component instanceof SampleFile) {
+        const filePath = component.filePath;
+        if (typeof filePath === "string") {
+          inputs.add(filePath);
+        }
+      } else if (component instanceof SampleDir) {
+        const dir = component.dir;
+        if (typeof dir === "string") {
+          inputs.add(`${dir}/**`);
+        }
+      }
+    }
+    return Array.from(inputs);
+  }
+  preSynthesize() {
+    let nextDependsOn = this.project.deps.all.filter((d) => d.version === "workspace:*").map((d) => [d.name, ROOT_TURBO_TASK_NAME].join("#"));
+    if (!this.isRootProject) {
+      [
+        [this.project.preCompileTask, this.preCompileTask],
+        [this.project.compileTask, this.compileTask],
+        [this.project.postCompileTask, this.postCompileTask],
+        [this.project.testTask, this.testTask],
+        [this.project.packageTask, this.packageTask]
+      ].forEach(([pjTask, turboTask]) => {
+        if (pjTask && turboTask && pjTask.steps.length > 0) {
+          if (nextDependsOn.length > 0) {
+            turboTask.dependsOn.push(...nextDependsOn);
+          }
+          nextDependsOn = [turboTask.name];
+        } else {
+          turboTask.isActive = false;
+        }
+      });
+      this.buildTask.dependsOn.push(...nextDependsOn);
+    }
+    const generatedInputs = this.generatedFileInputs();
+    const appendGeneratedInputs = (task) => {
+      if (!task) {
+        return;
+      }
+      for (const input of generatedInputs) {
+        if (!task.inputs.includes(input)) {
+          task.inputs.push(input);
+        }
+      }
+    };
+    if (this.isRootProject) {
+      appendGeneratedInputs(this.buildTask);
+    } else {
+      appendGeneratedInputs(this.preCompileTask);
+      appendGeneratedInputs(this.compileTask);
+      appendGeneratedInputs(this.postCompileTask);
+    }
+    const fileName = "turbo.json";
+    this.project.addPackageIgnore(fileName);
+    new JsonFile(this.project, fileName, {
+      obj: {
+        extends: this.extends.length ? this.extends : void 0,
+        globalDependencies: this.isRootProject && this.globalDependencies.length ? this.globalDependencies : void 0,
+        globalEnv: this.isRootProject && this.globalEnv.length ? this.globalEnv : void 0,
+        globalPassThroughEnv: this.isRootProject && this.globalPassThroughEnv.length ? this.globalPassThroughEnv : void 0,
+        ui: this.isRootProject ? this.ui : void 0,
+        dangerouslyDisablePackageManagerCheck: this.isRootProject ? this.dangerouslyDisablePackageManagerCheck : void 0,
+        cacheDir: this.isRootProject ? this.cacheDir : void 0,
+        envMode: this.isRootProject ? this.envMode : void 0,
+        /**
+         * All tasks
+         */
+        tasks: this.tasks.filter((task) => task.isActive).reduce(
+          (acc, task) => {
+            acc[task.name] = {
+              ...task.taskConfig()
+            };
+            return acc;
+          },
+          {
+            [this.buildTask.name]: { ...this.buildTask.taskConfig() }
+          }
+        )
+      }
+    });
+    super.preSynthesize();
+  }
+};
+_TurboRepo.buildWorkflowOptions = (remoteCacheOptions) => {
+  return {
+    env: {
+      GIT_BRANCH_NAME: "${{ github.head_ref || github.ref_name }}"
+    },
+    permissions: {
+      contents: JobPermission.WRITE,
+      idToken: JobPermission.WRITE
+    },
+    preBuildSteps: [
+      {
+        name: "AWS Creds for SSM",
+        uses: "aws-actions/configure-aws-credentials@v6",
+        with: {
+          ["role-to-assume"]: remoteCacheOptions.oidcRole,
+          ["aws-region"]: "us-east-1",
+          ["role-duration-seconds"]: "900"
+        }
+      }
+    ]
+  };
+};
+var TurboRepo = _TurboRepo;
+
+// src/agent/bundles/build-policy.ts
+var DEFAULT_BUILD_POLICY = {
+  remoteCacheEnabled: false
+};
+function resolveBuildPolicy(project) {
+  const remoteCacheOptions = TurboRepo.of(project)?.remoteCacheOptions;
+  if (!remoteCacheOptions) {
+    return DEFAULT_BUILD_POLICY;
+  }
+  return {
+    remoteCacheEnabled: true,
+    awsProfileName: remoteCacheOptions.profileName
+  };
+}
+
 // src/agent/bundles/business-models.ts
 var TEMPLATE_CANVAS = `---
 title: "Business Model: <Segment Name>"
@@ -10465,188 +10897,210 @@ var cleanMergedBranchesSkill = {
     }
   ]
 };
-var githubWorkflowBundle = {
-  name: "github-workflow",
-  description: "GitHub issue and PR workflow automation patterns",
-  appliesWhen: (project) => hasComponent(project, GitHub),
-  rules: [
-    {
-      name: "issue-workflow",
-      description: "Automated workflow for starting work on a GitHub issue",
-      scope: AGENT_RULE_SCOPE.ALWAYS,
-      content: [
-        "# Issue Workflow",
-        "",
-        '## "Work on issue X" Automation',
-        "",
-        "When the user says **work on issue X** (or similar), invoke the `issue-worker` agent in interactive mode, passing the issue number in the prompt. Do not perform the branch creation, issue fetching, or planning steps yourself \u2014 the agent handles the full workflow (claim, branch, plan, implement, PR) and will pause for your approval at the appropriate checkpoints."
-      ].join("\n"),
-      tags: ["workflow"]
-    },
-    {
-      name: "create-issue-workflow",
-      description: "Automated workflow for creating a new GitHub issue",
-      // ALWAYS scope: users invoke "create an issue" from any
-      // context, not only when editing agent / skill / bundle source.
-      // Consumers that want to narrow the load can override via
-      // `agentConfig.additionalRulePaths` or `excludeRules`.
-      scope: AGENT_RULE_SCOPE.ALWAYS,
-      content: [
-        "# Create Issue Workflow",
-        "",
-        '## "Create an issue" Automation',
-        "",
-        "When the user says **create an issue** (or similar), follow these steps exactly:",
-        "",
-        "1. **Determine the issue type prefix** from the user's description:",
-        "   - `epic:` \u2014 Large initiatives spanning multiple child issues",
-        "   - `feat:` \u2014 New features or functionality",
-        "   - `fix:` \u2014 Bug fixes",
-        "   - `chore:` \u2014 Maintenance: deps, tooling, config",
-        "   - `docs:` \u2014 Documentation-only work",
-        "   - `refactor:` \u2014 Code restructure, no behavior change",
-        "   - `release:` \u2014 Release preparation, version bumps",
-        "   - `hotfix:` \u2014 Urgent production fixes",
-        "   - If unclear, ask the user which type applies",
-        "2. **Compose the issue title** in the format: `<type>: <short description>`",
-        "3. **Determine the GitHub issue type** based on the prefix:",
-        "   - `epic:` \u2192 Epic",
-        "   - `feat:` \u2192 Feature",
-        "   - `fix:` \u2192 Bug",
-        "   - `chore:`, `docs:`, `refactor:`, `release:`, `hotfix:` \u2192 Task",
-        "4. **Identify prerequisite issues** \u2014 if the user mentions dependencies or blockers, include a **Dependencies** section in the body with `Depends on: #<issue-number>`",
-        "5. **Determine labels** \u2014 every issue must be created with the following labels:",
-        "   - **`type:*`** \u2014 derived from the issue title prefix:",
-        "     - `epic:` \u2192 `type:feat`",
-        "     - `feat:` \u2192 `type:feat`",
-        "     - `fix:` \u2192 `type:fix`",
-        "     - `chore:` \u2192 `type:chore`",
-        "     - `docs:` \u2192 `type:docs`",
-        "     - `refactor:` \u2192 `type:refactor`",
-        "     - `release:` \u2192 `type:release`",
-        "     - `hotfix:` \u2192 `type:hotfix`",
-        '   - **`priority:*`** \u2014 infer from the user\'s description when possible (e.g., "urgent"/"critical" \u2192 `priority:critical`, "important" \u2192 `priority:high`, "minor"/"low priority" \u2192 `priority:low`). If the priority is unclear, ask the user before creating the issue. Valid values: `priority:critical`, `priority:high`, `priority:medium`, `priority:low`, `priority:trivial`',
-        "   - **`status:ready`** \u2014 always add unless the issue has dependencies or blockers, in which case use `status:blocked`",
-        "6. **Create the issue** using `gh issue create`:",
-        "   - `--title '<type>: <description>'`",
-        "   - `--body '<issue body>'`",
-        "   - `--label '<type-label>' --label '<priority-label>' --label '<status-label>'`",
-        "7. **Set the GitHub issue type** by invoking the `set-issue-type.sh` helper (shipped with this bundle):",
-        "",
-        "   ```sh",
-        "   .claude/procedures/set-issue-type.sh <issue-number> <Feature|Task|Epic|Bug>",
-        "   ```",
-        "",
-        "   The helper resolves owner/repo, looks up the issue type node ID, looks up the issue node ID, and applies the `updateIssueIssueType` mutation in one step. It exits non-zero with a clear diagnostic on any error and lists available types if the type name is not recognised.",
-        "",
-        "   **Under the hood** (documented fallback if the helper is unavailable): the helper performs a two-step GraphQL flow \u2014 first a `repository(...).issueTypes` query to map the human-readable type name to a node ID, then the `updateIssueIssueType` mutation. The canonical queries are:",
-        "",
-        "   ```sh",
-        "   gh api graphql -f query='query($owner:String!,$repo:String!){repository(owner:$owner,name:$repo){issueTypes(first:50){nodes{id name}}}}' -f owner=<owner> -f repo=<repo>",
-        "   gh api graphql -f query='mutation($issueId:ID!,$typeId:ID!){updateIssueIssueType(input:{issueId:$issueId,issueTypeId:$typeId}){issue{number issueType{name}}}}' -f issueId=<issue-node-id> -f typeId=<issue-type-node-id>",
-        "   ```",
-        "",
-        "### Issue Body Template",
-        "",
-        "```markdown",
-        "## Summary",
-        "",
-        "<1-3 sentences describing the issue>",
-        "",
-        "## Details",
-        "",
-        "<Detailed description, acceptance criteria, or reproduction steps as appropriate>",
-        "",
-        "## Dependencies",
-        "",
-        "Depends on: #<issue-number> (if any, otherwise omit this section)",
-        "```",
-        "",
-        "### Important",
-        "",
-        "- Always use the conventional prefix in the issue title",
-        "- Always assign the correct GitHub issue type via the `set-issue-type.sh` helper (step 7) \u2014 never via `gh issue create --type`",
-        "- Always include `type:*`, `priority:*`, and `status:*` labels",
-        "- If the user does not specify a type, ask before creating the issue",
-        "- If the priority cannot be inferred from the description, ask the user before creating the issue",
-        "- Keep titles concise and descriptive"
-      ].join("\n"),
-      tags: ["workflow"]
-    },
-    {
-      name: "pr-workflow",
-      description: "Automated workflow for opening a pull request",
-      scope: AGENT_RULE_SCOPE.ALWAYS,
-      content: [
-        "# PR Workflow",
-        "",
-        '## "Open a PR" Automation',
-        "",
-        "When the user says **open a PR** (or similar), follow these steps exactly:",
-        "",
-        "1. **Regenerate project files** \u2014 run the three-step regen sequence (`pnpm i`, then `pnpm exec projen`, then `pnpm i` again) to ensure all generated files are up to date. The leading `pnpm i` is required because `pnpm exec projen` synthesises against whatever version of configulator (and projen, and any projen plugins) is currently resolved in `node_modules`; if the lockfile has moved past `node_modules` (typically right after `git pull` lands a dependency upgrade, or on a fresh checkout), synth runs against stale templates and produces phantom drift in `.claude/`, `.github/labels.yml`, `CLAUDE.md`, and other generated files. The trailing `pnpm i` picks up any dependency changes projen wrote into `package.json` during synth. Check `git diff` after the third step \u2014 if there are changes, commit them before proceeding.",
-        "2. **Run the full monorepo build** \u2014 run `pnpm build:all` to compile, lint, and test all packages (mirrors the CI pipeline). This command requires the user to be authenticated to AWS on the prod account used for Turborepo remote caching (`readonlyaccess-prod-525259625215-us-east-1` profile). If the command fails due to AWS credentials, ask the user to authenticate first. If the build produces changes to turbo inputs (typically snapshot files or ESLint auto-fixes), commit those changes and run `pnpm build:all` again \u2014 the build must complete cleanly with no uncommitted changes.",
-        "3. **Check for uncommitted changes** \u2014 if any exist, commit them with a conventional commit message",
-        "4. **Pull and rebase from the default branch** \u2014 run `git pull origin {{repository.defaultBranch}} --rebase` to incorporate the latest changes and resolve any conflicts before pushing",
-        "5. **Push the branch** to origin: `git push -u origin <branch>`",
-        "6. **Create the PR** using `gh pr create`:",
-        "   - **Title**: use a conventional commit style title (e.g., `feat(scope): short description`)",
-        "   - **Body**: include `Closes #<issue-number>` (derived from the branch name) and a brief summary of changes",
-        "7. **Delegate review and merge to the `pr-reviewer` sub-agent.** After the PR is created, invoke the `/review-pr <pr-number>` skill (or otherwise hand the new PR number to the `pr-reviewer` sub-agent). The reviewer verifies the diff against the linked issue's acceptance criteria and enables squash auto-merge when all checks pass. Do **not** run `gh pr merge --auto` yourself \u2014 review/merge policy lives solely in the `pr-reviewer` agent.",
-        "",
-        "### PR Body Template",
-        "",
-        "```markdown",
-        "## Summary",
-        "",
-        "<1-3 bullet points describing what changed and why>",
-        "",
-        "Closes #<issue-number>",
-        "",
-        "## Test Plan",
-        "",
-        "- [ ] Tests pass locally",
-        "- [ ] Relevant changes have been reviewed",
-        "```",
-        "",
-        "### Important",
-        "",
-        "- Always derive the issue number from the branch name (e.g., `feat/42-add-login` \u2192 `#42`)",
-        "- Use conventional commit format for the PR title",
-        "- Delegate merge to the `pr-reviewer` sub-agent \u2014 do not merge manually and do not enable auto-merge directly"
-      ].join("\n"),
-      tags: ["workflow"]
-    },
-    {
-      name: "branch-cleanup",
-      description: "Local-branch hygiene helpers shipped with the github-workflow bundle, including the /clean-merged-branches skill for safely force-deleting branches whose content has already merged into the base (handles squash merges).",
-      scope: AGENT_RULE_SCOPE.ALWAYS,
-      content: [
-        "# Branch Cleanup",
-        "",
-        "Local branches accumulate after every merged PR. In squash-merge",
-        "repositories `git branch -d` refuses to delete them because the",
-        "commit hash on the base differs, even when the branch content is",
-        "fully merged. The `github-workflow` bundle ships two affordances",
-        "that use content-equality (not commit-graph reachability) to",
-        "identify branches safe to force-delete:",
-        "",
-        "- `/clean-merged-branches` \u2014 interactive slash-command skill that",
-        "  classifies every local branch, prompts for confirmation, then",
-        "  runs `git branch -D` on the confirmed list. See",
-        "  `.claude/skills/clean-merged-branches/SKILL.md` for usage,",
-        "  output format, and the squash-merge verification algorithm.",
-        "- `.claude/procedures/clean-merged-branches.sh` \u2014 analysis-only",
-        "  procedure for non-interactive agent use (orchestrator,",
-        "  maintenance-audit). NEVER deletes \u2014 only reports `MERGED` /",
-        "  `UNMERGED` / `EMPTY` / `SKIP_WORKTREE` lines."
-      ].join("\n"),
-      tags: ["workflow"]
-    }
-  ],
-  skills: [cleanMergedBranchesSkill],
-  procedures: [setIssueTypeProcedure, cleanMergedBranchesProcedure]
-};
+function renderPrWorkflowBuildStep(policy) {
+  const lines = [
+    "2. **Run the build \u2014 scoped to what changed.**",
+    "",
+    "   - **Documentation-only changes** \u2014 a diff confined to documentation content (markdown pages, no source, config, or projen inputs) does **not** require `pnpm build:all`. There is nothing to compile, and CI is the authoritative content gate. Commit the content and proceed to the next step.",
+    "   - **Everything else** \u2014 when the change touches build inputs (source code, `.projenrc.ts`, `projenrc/**`, or any other projen-generated config), run `pnpm build:all` to compile, lint, and test all packages (mirrors the CI pipeline). If the build produces changes to turbo inputs (typically snapshot files or ESLint auto-fixes), commit those changes and run `pnpm build:all` again \u2014 the build must complete cleanly with no uncommitted changes."
+  ];
+  if (policy.remoteCacheEnabled && policy.awsProfileName) {
+    lines.push(
+      "",
+      `   \`pnpm build:all\` uses the Turborepo **remote cache**, which requires the user to be authenticated to AWS on the \`${policy.awsProfileName}\` profile. If the command fails due to AWS credentials, ask the user to authenticate first.`
+    );
+  }
+  lines.push(
+    "",
+    "   **Never background a long build and end the turn.** If you run a build, run it in the **foreground** to completion before committing, pushing, or opening the PR. Launching `pnpm build:all` as a background process and ending your turn while it is still running strands the deliverable uncommitted \u2014 that work is lost. This is the documented root cause of autonomous worker-stall incidents."
+  );
+  return lines;
+}
+function buildGithubWorkflowBundle(buildPolicy = DEFAULT_BUILD_POLICY) {
+  return {
+    name: "github-workflow",
+    description: "GitHub issue and PR workflow automation patterns",
+    appliesWhen: (project) => hasComponent(project, GitHub),
+    rules: [
+      {
+        name: "issue-workflow",
+        description: "Automated workflow for starting work on a GitHub issue",
+        scope: AGENT_RULE_SCOPE.ALWAYS,
+        content: [
+          "# Issue Workflow",
+          "",
+          '## "Work on issue X" Automation',
+          "",
+          "When the user says **work on issue X** (or similar), invoke the `issue-worker` agent in interactive mode, passing the issue number in the prompt. Do not perform the branch creation, issue fetching, or planning steps yourself \u2014 the agent handles the full workflow (claim, branch, plan, implement, PR) and will pause for your approval at the appropriate checkpoints."
+        ].join("\n"),
+        tags: ["workflow"]
+      },
+      {
+        name: "create-issue-workflow",
+        description: "Automated workflow for creating a new GitHub issue",
+        // ALWAYS scope: users invoke "create an issue" from any
+        // context, not only when editing agent / skill / bundle source.
+        // Consumers that want to narrow the load can override via
+        // `agentConfig.additionalRulePaths` or `excludeRules`.
+        scope: AGENT_RULE_SCOPE.ALWAYS,
+        content: [
+          "# Create Issue Workflow",
+          "",
+          '## "Create an issue" Automation',
+          "",
+          "When the user says **create an issue** (or similar), follow these steps exactly:",
+          "",
+          "1. **Determine the issue type prefix** from the user's description:",
+          "   - `epic:` \u2014 Large initiatives spanning multiple child issues",
+          "   - `feat:` \u2014 New features or functionality",
+          "   - `fix:` \u2014 Bug fixes",
+          "   - `chore:` \u2014 Maintenance: deps, tooling, config",
+          "   - `docs:` \u2014 Documentation-only work",
+          "   - `refactor:` \u2014 Code restructure, no behavior change",
+          "   - `release:` \u2014 Release preparation, version bumps",
+          "   - `hotfix:` \u2014 Urgent production fixes",
+          "   - If unclear, ask the user which type applies",
+          "2. **Compose the issue title** in the format: `<type>: <short description>`",
+          "3. **Determine the GitHub issue type** based on the prefix:",
+          "   - `epic:` \u2192 Epic",
+          "   - `feat:` \u2192 Feature",
+          "   - `fix:` \u2192 Bug",
+          "   - `chore:`, `docs:`, `refactor:`, `release:`, `hotfix:` \u2192 Task",
+          "4. **Identify prerequisite issues** \u2014 if the user mentions dependencies or blockers, include a **Dependencies** section in the body with `Depends on: #<issue-number>`",
+          "5. **Determine labels** \u2014 every issue must be created with the following labels:",
+          "   - **`type:*`** \u2014 derived from the issue title prefix:",
+          "     - `epic:` \u2192 `type:feat`",
+          "     - `feat:` \u2192 `type:feat`",
+          "     - `fix:` \u2192 `type:fix`",
+          "     - `chore:` \u2192 `type:chore`",
+          "     - `docs:` \u2192 `type:docs`",
+          "     - `refactor:` \u2192 `type:refactor`",
+          "     - `release:` \u2192 `type:release`",
+          "     - `hotfix:` \u2192 `type:hotfix`",
+          '   - **`priority:*`** \u2014 infer from the user\'s description when possible (e.g., "urgent"/"critical" \u2192 `priority:critical`, "important" \u2192 `priority:high`, "minor"/"low priority" \u2192 `priority:low`). If the priority is unclear, ask the user before creating the issue. Valid values: `priority:critical`, `priority:high`, `priority:medium`, `priority:low`, `priority:trivial`',
+          "   - **`status:ready`** \u2014 always add unless the issue has dependencies or blockers, in which case use `status:blocked`",
+          "6. **Create the issue** using `gh issue create`:",
+          "   - `--title '<type>: <description>'`",
+          "   - `--body '<issue body>'`",
+          "   - `--label '<type-label>' --label '<priority-label>' --label '<status-label>'`",
+          "7. **Set the GitHub issue type** by invoking the `set-issue-type.sh` helper (shipped with this bundle):",
+          "",
+          "   ```sh",
+          "   .claude/procedures/set-issue-type.sh <issue-number> <Feature|Task|Epic|Bug>",
+          "   ```",
+          "",
+          "   The helper resolves owner/repo, looks up the issue type node ID, looks up the issue node ID, and applies the `updateIssueIssueType` mutation in one step. It exits non-zero with a clear diagnostic on any error and lists available types if the type name is not recognised.",
+          "",
+          "   **Under the hood** (documented fallback if the helper is unavailable): the helper performs a two-step GraphQL flow \u2014 first a `repository(...).issueTypes` query to map the human-readable type name to a node ID, then the `updateIssueIssueType` mutation. The canonical queries are:",
+          "",
+          "   ```sh",
+          "   gh api graphql -f query='query($owner:String!,$repo:String!){repository(owner:$owner,name:$repo){issueTypes(first:50){nodes{id name}}}}' -f owner=<owner> -f repo=<repo>",
+          "   gh api graphql -f query='mutation($issueId:ID!,$typeId:ID!){updateIssueIssueType(input:{issueId:$issueId,issueTypeId:$typeId}){issue{number issueType{name}}}}' -f issueId=<issue-node-id> -f typeId=<issue-type-node-id>",
+          "   ```",
+          "",
+          "### Issue Body Template",
+          "",
+          "```markdown",
+          "## Summary",
+          "",
+          "<1-3 sentences describing the issue>",
+          "",
+          "## Details",
+          "",
+          "<Detailed description, acceptance criteria, or reproduction steps as appropriate>",
+          "",
+          "## Dependencies",
+          "",
+          "Depends on: #<issue-number> (if any, otherwise omit this section)",
+          "```",
+          "",
+          "### Important",
+          "",
+          "- Always use the conventional prefix in the issue title",
+          "- Always assign the correct GitHub issue type via the `set-issue-type.sh` helper (step 7) \u2014 never via `gh issue create --type`",
+          "- Always include `type:*`, `priority:*`, and `status:*` labels",
+          "- If the user does not specify a type, ask before creating the issue",
+          "- If the priority cannot be inferred from the description, ask the user before creating the issue",
+          "- Keep titles concise and descriptive"
+        ].join("\n"),
+        tags: ["workflow"]
+      },
+      {
+        name: "pr-workflow",
+        description: "Automated workflow for opening a pull request",
+        scope: AGENT_RULE_SCOPE.ALWAYS,
+        content: [
+          "# PR Workflow",
+          "",
+          '## "Open a PR" Automation',
+          "",
+          "When the user says **open a PR** (or similar), follow these steps exactly:",
+          "",
+          "1. **Regenerate project files** \u2014 run the three-step regen sequence (`pnpm i`, then `pnpm exec projen`, then `pnpm i` again) to ensure all generated files are up to date. The leading `pnpm i` is required because `pnpm exec projen` synthesises against whatever version of configulator (and projen, and any projen plugins) is currently resolved in `node_modules`; if the lockfile has moved past `node_modules` (typically right after `git pull` lands a dependency upgrade, or on a fresh checkout), synth runs against stale templates and produces phantom drift in `.claude/`, `.github/labels.yml`, `CLAUDE.md`, and other generated files. The trailing `pnpm i` picks up any dependency changes projen wrote into `package.json` during synth. Check `git diff` after the third step \u2014 if there are changes, commit them before proceeding.",
+          ...renderPrWorkflowBuildStep(buildPolicy),
+          "3. **Check for uncommitted changes** \u2014 if any exist, commit them with a conventional commit message",
+          "4. **Pull and rebase from the default branch** \u2014 run `git pull origin {{repository.defaultBranch}} --rebase` to incorporate the latest changes and resolve any conflicts before pushing",
+          "5. **Push the branch** to origin: `git push -u origin <branch>`",
+          "6. **Create the PR** using `gh pr create`:",
+          "   - **Title**: use a conventional commit style title (e.g., `feat(scope): short description`)",
+          "   - **Body**: include `Closes #<issue-number>` (derived from the branch name) and a brief summary of changes",
+          "7. **Delegate review and merge to the `pr-reviewer` sub-agent.** After the PR is created, invoke the `/review-pr <pr-number>` skill (or otherwise hand the new PR number to the `pr-reviewer` sub-agent). The reviewer verifies the diff against the linked issue's acceptance criteria and enables squash auto-merge when all checks pass. Do **not** run `gh pr merge --auto` yourself \u2014 review/merge policy lives solely in the `pr-reviewer` agent.",
+          "",
+          "### PR Body Template",
+          "",
+          "```markdown",
+          "## Summary",
+          "",
+          "<1-3 bullet points describing what changed and why>",
+          "",
+          "Closes #<issue-number>",
+          "",
+          "## Test Plan",
+          "",
+          "- [ ] Tests pass locally",
+          "- [ ] Relevant changes have been reviewed",
+          "```",
+          "",
+          "### Important",
+          "",
+          "- Always derive the issue number from the branch name (e.g., `feat/42-add-login` \u2192 `#42`)",
+          "- Use conventional commit format for the PR title",
+          "- Delegate merge to the `pr-reviewer` sub-agent \u2014 do not merge manually and do not enable auto-merge directly"
+        ].join("\n"),
+        tags: ["workflow"]
+      },
+      {
+        name: "branch-cleanup",
+        description: "Local-branch hygiene helpers shipped with the github-workflow bundle, including the /clean-merged-branches skill for safely force-deleting branches whose content has already merged into the base (handles squash merges).",
+        scope: AGENT_RULE_SCOPE.ALWAYS,
+        content: [
+          "# Branch Cleanup",
+          "",
+          "Local branches accumulate after every merged PR. In squash-merge",
+          "repositories `git branch -d` refuses to delete them because the",
+          "commit hash on the base differs, even when the branch content is",
+          "fully merged. The `github-workflow` bundle ships two affordances",
+          "that use content-equality (not commit-graph reachability) to",
+          "identify branches safe to force-delete:",
+          "",
+          "- `/clean-merged-branches` \u2014 interactive slash-command skill that",
+          "  classifies every local branch, prompts for confirmation, then",
+          "  runs `git branch -D` on the confirmed list. See",
+          "  `.claude/skills/clean-merged-branches/SKILL.md` for usage,",
+          "  output format, and the squash-merge verification algorithm.",
+          "- `.claude/procedures/clean-merged-branches.sh` \u2014 analysis-only",
+          "  procedure for non-interactive agent use (orchestrator,",
+          "  maintenance-audit). NEVER deletes \u2014 only reports `MERGED` /",
+          "  `UNMERGED` / `EMPTY` / `SKIP_WORKTREE` lines."
+        ].join("\n"),
+        tags: ["workflow"]
+      }
+    ],
+    skills: [cleanMergedBranchesSkill],
+    procedures: [setIssueTypeProcedure, cleanMergedBranchesProcedure]
+  };
+}
+var githubWorkflowBundle = buildGithubWorkflowBundle();
 
 // src/agent/bundles/industry-discovery.ts
 function buildIndustryDiscoveryAnalystSubAgent(paths, issueDefaults) {
@@ -14818,13 +15272,16 @@ function renderUnblockDependentsSection(ud) {
     "",
     "1. Searches open issues for `Depends on: #<closed>` references in",
     "   their body.",
-    "2. For each match, re-reads every dependency listed across",
+    "2. Skips any match carrying `status:deferred`, emitting a",
+    "   `SKIP_DEFERRED` line. A human-parked issue is never promoted by",
+    "   a sweep, no matter how its dependencies resolve.",
+    "3. For each remaining match, re-reads every dependency listed across",
     "   **all** `Depends on:` lines in the body (bodies routinely list",
     "   one dependency per line) and checks whether they are all closed.",
-    "3. If **all** dependencies are closed, flips the dependent from",
+    "4. If **all** dependencies are closed, flips the dependent from",
     "   `status:blocked` to `status:ready` and posts a one-line comment",
     "   citing the resolving issue.",
-    "4. If **some** dependencies are still open, leaves the dependent",
+    "5. If **some** dependencies are still open, leaves the dependent",
     "   as `status:blocked` and optionally posts a partial-unblock",
     "   comment (see the **Partial unblock behaviour** subsection",
     "   below).",
@@ -14858,6 +15315,7 @@ function renderUnblockDependentsSection(ud) {
     'UNBLOCKED #<dep> \u2014 all deps closed (<closed-list>) \u2014 "<title>"',
     'UNBLOCK_FAILED #<dep> \u2014 label flip failed (all deps closed: <closed-list>) \u2014 "<title>"',
     'STILL_BLOCKED #<dep> \u2014 waiting on <open-list> \u2014 "<title>"',
+    'SKIP_DEFERRED #<dep> \u2014 status:deferred; human-parked, not promoting \u2014 "<title>"',
     "NO_DEPENDENTS #<closed>",
     "```",
     "",
@@ -14867,7 +15325,10 @@ function renderUnblockDependentsSection(ud) {
     "error, permissions, or the dependent went stale between the",
     "search and the edit) \u2014 a human needs to retry or flip the label",
     "manually. `STILL_BLOCKED` lines mean the dependent stays blocked",
-    "pending other open deps. `NO_DEPENDENTS` means no open issue",
+    "pending other open deps. `SKIP_DEFERRED` lines mean the dependent",
+    "carries `status:deferred` and was deliberately left blocked even",
+    "though its dependencies resolved \u2014 the sweep never promotes a",
+    "human-parked issue. `NO_DEPENDENTS` means no open issue",
     "references the just-closed issue in a `Depends on:` line.",
     "",
     "### Partial unblock behaviour",
@@ -15018,7 +15479,7 @@ function renderUnblockDependentsScript(ud) {
     "# `status:blocked` \u2192 `status:ready` directly on the overflow.",
     'dependents=$(gh issue list --label "status:blocked" --state open \\',
     '  --search "in:body \\"Depends on:\\"" \\',
-    '  --json number,title,body --limit 100 2>/dev/null || echo "[]")',
+    '  --json number,title,body,labels --limit 100 2>/dev/null || echo "[]")',
     "",
     `count=$(echo "$dependents" | jq 'length')`,
     'if [[ "$count" -eq 0 ]]; then',
@@ -15026,6 +15487,18 @@ function renderUnblockDependentsScript(ud) {
     "  exit 0",
     "fi",
     "",
+    "# Human-parked candidates (`status:deferred`). Collected jq-side into a",
+    "# space-delimited lookup string rather than threaded through the",
+    "# tab-separated records below: an extra TSV field would either sit after",
+    "# dep_line (displacing the mandatory-last optional field) or before it",
+    "# (reintroducing the #884 IFS tab-collapse bug). The skip itself happens",
+    "# inside the loop, after the closed-issue reference test, so an unrelated",
+    "# deferred issue in the search window never emits a line. No agent or",
+    "# sweep ever removes `status:deferred` \u2014 only a human promotes it.",
+    `deferred_set=" $(echo "$dependents" | jq -r '`,
+    '  .[] | select(.labels | map(.name) | index("status:deferred")) | .number',
+    `' | tr '\\n' ' ')"`,
+    "",
     "# Union every `Depends on:` line per candidate (a body may list one",
     "# dependency per line) into a single space-joined dep string and stream",
     "# as tab-separated number / title / dep-line tuples.",
@@ -15061,6 +15534,14 @@ function renderUnblockDependentsScript(ud) {
     "",
     "  found_any=true",
     "",
+    "  # Deliberately-parked dependents never get promoted by a sweep, even",
+    "  # when every dependency has closed. Only a human clears",
+    "  # `status:deferred`.",
+    '  if [[ "$deferred_set" == *" ${num} "* ]]; then',
+    '    echo "SKIP_DEFERRED #${num} \u2014 status:deferred; human-parked, not promoting \u2014 \\"${title}\\""',
+    "    continue",
+    "  fi",
+    "",
     "  # Re-check every dep in the list. Fully-closed \u2192 unblock.",
     "  all_closed=true",
     '  open_deps=""',
@@ -15250,15 +15731,26 @@ function buildCheckBlockedScript(tiers, scopeGate, _runRatio) {
     "  # position.",
     "  local issues",
     '  issues=$(gh issue list --label "status:blocked" --state open \\',
-    '    --json number,body --limit 1000 2>/dev/null || echo "[]")',
+    '    --json number,body,labels --limit 1000 2>/dev/null || echo "[]")',
     "",
     "  local count",
     `  count=$(echo "$issues" | jq 'length')`,
     '  if [[ "$count" -eq 0 ]]; then',
-    '    echo "TRIAGE_DONE unblocked=0 still_blocked=0"',
+    '    echo "TRIAGE_DONE unblocked=0 still_blocked=0 deferred_skipped=0"',
     "    return 0",
     "  fi",
     "",
+    "  # Human-parked candidates (`status:deferred`). Collected jq-side into",
+    "  # a space-delimited lookup string rather than threaded through the",
+    "  # tab-separated records below: an extra TSV field would either sit",
+    "  # after dep_line (displacing the mandatory-last optional field) or",
+    "  # before it (reintroducing the #884 IFS tab-collapse bug). No agent",
+    "  # or sweep ever removes `status:deferred` \u2014 only a human promotes it.",
+    "  local deferred_set",
+    `  deferred_set=" $(echo "$issues" | jq -r '`,
+    '    .[] | select(.labels | map(.name) | index("status:deferred")) | .number',
+    `  ' | tr '\\n' ' ')"`,
+    "",
     "  local issue_data",
     `  issue_data=$(echo "$issues" | jq -r '`,
     "    .[] |",
@@ -15271,10 +15763,20 @@ function buildCheckBlockedScript(tiers, scopeGate, _runRatio) {
     "  # mirroring unblock-dependents.sh.",
     "  local unblocked_count=0",
     "  local still_blocked_count=0",
+    "  local deferred_skipped_count=0",
     "",
     "  while IFS=$'\\t' read -r num dep_line; do",
     '    [[ -z "$num" ]] && continue',
     "",
+    "    # Deliberately-parked issues never get promoted by a sweep, even",
+    "    # when every dependency has closed. Only a human clears",
+    "    # `status:deferred`.",
+    '    if [[ "$deferred_set" == *" ${num} "* ]]; then',
+    '      echo "SKIP_DEFERRED #${num} \u2014 status:deferred; human-parked, not promoting"',
+    "      deferred_skipped_count=$((deferred_skipped_count + 1))",
+    "      continue",
+    "    fi",
+    "",
     '    if [[ -z "$dep_line" ]]; then',
     '      echo "BLOCKED #${num} \u2014 no Depends on field found"',
     "      still_blocked_count=$((still_blocked_count + 1))",
@@ -15335,7 +15837,7 @@ function buildCheckBlockedScript(tiers, scopeGate, _runRatio) {
     '  done <<< "$issue_data"',
     "",
     "  # Single summary line consumed by the orchestrator.",
-    '  echo "TRIAGE_DONE unblocked=${unblocked_count} still_blocked=${still_blocked_count}"',
+    '  echo "TRIAGE_DONE unblocked=${unblocked_count} still_blocked=${still_blocked_count} deferred_skipped=${deferred_skipped_count}"',
     "}",
     "",
     "cmd_eligible() {",
@@ -15359,11 +15861,26 @@ function buildCheckBlockedScript(tiers, scopeGate, _runRatio) {
     "      continue",
     "    fi",
     "",
+    "    # Dispatch exclusions. `gh issue list` has no negative-label filter",
+    "    # for a label-filtered (non-search) listing, so both exclusions run",
+    "    # jq-side over the labels already fetched above \u2014 no new TSV field",
+    "    # is needed, and the mandatory-last dep_line ordering is untouched.",
+    "    #   - `status:needs-attention` is additive (it no longer replaces the",
+    "    #     base status), so a scope-gate-flagged issue keeps `status:ready`",
+    "    #     and would re-surface in every scan until a human clears the flag",
+    "    #     (#901). It is never dispatchable, so drop it from the scan.",
+    "    #   - `status:deferred` is human-parked: captured for provenance and",
+    "    #     never auto-dispatched. `status:ready` + `status:deferred` is",
+    "    #     reachable (e.g. after an unblock or a manual edit), so exclude",
+    "    #     it here as the dispatch-side half of the #887 guard.",
     "    local issue_data",
     `    issue_data=$(echo "$issues" | jq -r '`,
     "      .[] |",
+    "      (.labels | map(.name)) as $names |",
+    '      select($names | index("status:needs-attention") | not) |',
+    '      select($names | index("status:deferred") | not) |',
     '      (.body | split("\\n") | map(select(test("Depends on:"; "i"))) | join(" ")) as $dep_line |',
-    '      (.labels | map(.name) | map(select(startswith("type:"))) | .[0] // "") as $type_label |',
+    '      ($names | map(select(startswith("type:"))) | .[0] // "") as $type_label |',
     '      "\\(.number)\\t\\(.title)\\t\\($type_label)\\t\\($dep_line)"',
     "    ')",
     "",
@@ -16007,7 +16524,7 @@ function buildCheckBlockedScript(tiers, scopeGate, _runRatio) {
 function buildCheckBlockedProcedure(tiers, scopeGate = resolveScopeGate(), runRatio = resolveRunRatio()) {
   return {
     name: "check-blocked.sh",
-    description: "Token-efficient issue triage script with subcommands: eligible, unblock, stale, orphaned, lease-reconcile, maintenance, prs, scope. Sorts eligible issues by priority desc \u2192 funnel tier asc \u2192 issue number asc; the scope subcommand classifies a single issue against the scope-gate thresholds; the unblock subcommand applies the `status:blocked` \u2192 `status:ready` label flip itself, posts the canned unblock comment, and emits a single `TRIAGE_DONE unblocked=N still_blocked=M` summary line; the lease-reconcile subcommand auto-reconciles stuck `review:fixing` PR leases \u2014 re-applying `review:needs-worker` on an orphaned lease (fix-list stale, no worker report) so the Phase B1 drain retries, and removing `review:needs-worker` on a consumed-but-uncleared wedge (branch HEAD advanced past the fix-list, marker still set, no worker report) so the reviewer confirm pass can merge, always posting an audit-trail note comment and emitting a single `LEASE_RECONCILE orphaned=N consumed_uncleared=M` summary line; the maintenance subcommand flags stale issues with `status:needs-attention` (never auto-resets to `status:ready`), counts orphan branches/PRs, folds in the lease-reconcile sweep, and emits a `MAINTENANCE_DONE flagged_stale=N flagged_blocked=M orphan_branches=A orphan_prs=B needs_attention_total=T` summary line followed by the `LEASE_RECONCILE` line.",
+    description: "Token-efficient issue triage script with subcommands: eligible, unblock, stale, orphaned, lease-reconcile, maintenance, prs, scope. Sorts eligible issues by priority desc \u2192 funnel tier asc \u2192 issue number asc, excluding issues carrying `status:needs-attention` or `status:deferred`; the scope subcommand classifies a single issue against the scope-gate thresholds; the unblock subcommand applies the `status:blocked` \u2192 `status:ready` label flip itself, posts the canned unblock comment, skips human-parked `status:deferred` candidates with a `SKIP_DEFERRED` line, and emits a single `TRIAGE_DONE unblocked=N still_blocked=M deferred_skipped=K` summary line; the lease-reconcile subcommand auto-reconciles stuck `review:fixing` PR leases \u2014 re-applying `review:needs-worker` on an orphaned lease (fix-list stale, no worker report) so the Phase B1 drain retries, and removing `review:needs-worker` on a consumed-but-uncleared wedge (branch HEAD advanced past the fix-list, marker still set, no worker report) so the reviewer confirm pass can merge, always posting an audit-trail note comment and emitting a single `LEASE_RECONCILE orphaned=N consumed_uncleared=M` summary line; the maintenance subcommand flags stale issues with `status:needs-attention` (never auto-resets to `status:ready`), counts orphan branches/PRs, folds in the lease-reconcile sweep, and emits a `MAINTENANCE_DONE flagged_stale=N flagged_blocked=M orphan_branches=A orphan_prs=B needs_attention_total=T` summary line followed by the `LEASE_RECONCILE` line.",
     content: buildCheckBlockedScript(tiers, scopeGate, runRatio)
   };
 }
@@ -16689,14 +17206,20 @@ var orchestratorSubAgent = {
     "The script emits one summary line in this shape:",
     "",
     "```",
-    "TRIAGE_DONE unblocked=<N> still_blocked=<M>",
+    "TRIAGE_DONE unblocked=<N> still_blocked=<M> deferred_skipped=<K>",
     "```",
     "",
     "Per-issue informational lines (`UNBLOCKED #N`, `UNBLOCK_FAILED #N`,",
-    "`STILL_BLOCKED #N`, `BLOCKED #N \u2014 no Depends on field found`) are",
-    "emitted for log visibility but are **not** load-bearing for the",
-    "orchestrator \u2014 partial failures (one bad `gh` call) do not abort",
-    "the sweep, they are simply counted toward `still_blocked`.",
+    "`STILL_BLOCKED #N`, `SKIP_DEFERRED #N`, `BLOCKED #N \u2014 no Depends on",
+    "field found`) are emitted for log visibility but are **not**",
+    "load-bearing for the orchestrator \u2014 partial failures (one bad `gh`",
+    "call) do not abort the sweep, they are simply counted toward",
+    "`still_blocked`.",
+    "",
+    "`deferred_skipped` counts candidates the sweep deliberately left",
+    "blocked because they carry `status:deferred`. Those issues are",
+    "human-parked: no agent or sweep ever removes `status:deferred`, so",
+    "a non-zero count is expected steady-state noise, not a failure.",
     "",
     "This phase is the **fallback safety net** for agent-driven",
     "unblocking. Every agent that applies `status:done` already runs",
@@ -17876,9 +18399,11 @@ var checkBlockedCommand = {
     "reference, applies the `status:blocked` \u2192 `status:ready` label flip",
     "itself, posts the canned `Dependencies resolved \u2014 unblocking.`",
     "comment, and emits a single",
-    "`TRIAGE_DONE unblocked=<N> still_blocked=<M>` summary line. Per-issue",
-    "informational lines (`UNBLOCKED`, `UNBLOCK_FAILED`, `STILL_BLOCKED`)",
-    "are also emitted for log visibility.",
+    "`TRIAGE_DONE unblocked=<N> still_blocked=<M> deferred_skipped=<K>`",
+    "summary line. Candidates carrying `status:deferred` are skipped",
+    "rather than promoted \u2014 only a human clears that label. Per-issue",
+    "informational lines (`UNBLOCKED`, `UNBLOCK_FAILED`, `STILL_BLOCKED`,",
+    "`SKIP_DEFERRED`) are also emitted for log visibility.",
     "",
     "Summarise the output (the `TRIAGE_DONE` counts and the first few",
     "per-issue lines) \u2014 do **not** apply additional label flips yourself;",
@@ -18886,7 +19411,7 @@ var peopleProfileBundle = buildPeopleProfileBundle();
 
 // src/pnpm/pnpm-workspace.ts
 import { relative } from "path";
-import { Component, YamlFile } from "projen";
+import { Component as Component3, YamlFile } from "projen";
 var MINIMUM_RELEASE_AGE = {
   ZERO_DAYS: 0,
   ONE_HOUR: 60,
@@ -18900,7 +19425,7 @@ var MINIMUM_RELEASE_AGE = {
   SIX_DAYS: 8640,
   ONE_WEEK: 10080
 };
-var PnpmWorkspace = class _PnpmWorkspace extends Component {
+var PnpmWorkspace = class _PnpmWorkspace extends Component3 {
   /**
    * Get the pnpm workspace component of a project. If it does not exist,
    * return undefined.
@@ -28465,7 +28990,7 @@ function buildResearchPipelineBundle(paths = DEFAULT_AGENT_PATHS, issueDefaults
 var researchPipelineBundle = buildResearchPipelineBundle();
 
 // src/projects/project-metadata.ts
-import { Component as Component2 } from "projen";
+import { Component as Component4 } from "projen";
 import { NodeProject } from "projen/lib/javascript";
 var GITHUB_HTTPS_RE = /(?:https?:\/\/|git\+https:\/\/)github\.com\/([^/]+)\/([^/.]+)(?:\.git)?/;
 var GITHUB_SSH_RE = /git@github\.com:([^/]+)\/([^/.]+)(?:\.git)?/;
@@ -28480,7 +29005,7 @@ function parseGitHubUrl(url) {
   }
   return { owner: void 0, name: void 0 };
 }
-var ProjectMetadata = class _ProjectMetadata extends Component2 {
+var ProjectMetadata = class _ProjectMetadata extends Component4 {
   /**
    * Returns the ProjectMetadata instance for a project. Walks up the parent
    * chain so sub-projects resolve the metadata declared on a root
@@ -31077,435 +31602,56 @@ function buildStandardsResearchBundle(paths = DEFAULT_AGENT_PATHS, issueDefaults
 }
 var standardsResearchBundle = buildStandardsResearchBundle();
 
-// src/turbo/turbo-repo.ts
-import {
-  Component as Component4,
-  FileBase,
-  JsonFile,
-  SampleDir,
-  SampleFile
-} from "projen/lib";
-import { JobPermission } from "projen/lib/github/workflows-model";
-
-// src/turbo/turbo-repo-task.ts
-import { Component as Component3 } from "projen/lib";
-var TurboRepoTask = class extends Component3 {
-  constructor(project, options) {
-    super(project);
-    this.project = project;
-    this.name = options.name;
-    this.dependsOn = options.dependsOn ?? [];
-    this.env = options.env ?? [];
-    this.passThroughEnv = options.passThroughEnv ?? [];
-    this.outputs = options.outputs ?? [];
-    this.cache = options.cache ?? true;
-    this.inputs = [
-      ...options.inputs ?? [],
-      // rerun if projen config changes
-      ".projen/**",
-      // ignore mac files
-      "!.DS_Store",
-      "!**/.DS_Store"
-    ];
-    this.outputLogs = options.outputLogs ?? "new-only";
-    this.persistent = options.persistent ?? false;
-    this.interactive = options.interactive ?? false;
-    this.isActive = true;
-  }
-  taskConfig() {
-    return {
-      dependsOn: this.dependsOn,
-      env: this.env,
-      passThroughEnv: this.passThroughEnv,
-      outputs: this.outputs,
-      cache: this.cache,
-      inputs: this.inputs,
-      outputLogs: this.outputLogs,
-      persistent: this.persistent,
-      interactive: this.interactive
-    };
-  }
-};
-
-// src/turbo/turbo-repo.ts
-var ROOT_TURBO_TASK_NAME = "turbo:build";
-var ROOT_CI_TASK_NAME = "build:all";
-var _TurboRepo = class _TurboRepo extends Component4 {
-  constructor(project, options = {}) {
-    super(project);
-    this.project = project;
-    /**
-     * Sub-Tasks to run
-     */
-    this.tasks = [];
-    this.turboVersion = options.turboVersion ?? "catalog:";
-    this.isRootProject = project === project.root;
-    if (this.isRootProject) {
-      project.addDevDeps(`turbo@${this.turboVersion}`);
-    }
-    project.gitignore.addPatterns("/.turbo");
-    project.npmignore?.addPatterns("/.turbo/");
-    this.extends = options.extends ?? (this.isRootProject ? [] : ["//"]);
-    this.globalDependencies = options.globalDependencies ?? [];
-    this.globalEnv = options.globalEnv ?? [];
-    this.globalPassThroughEnv = options.globalPassThroughEnv ?? [];
-    this.ui = options.ui ?? "stream";
-    this.dangerouslyDisablePackageManagerCheck = options.dangerouslyDisablePackageManagerCheck ?? false;
-    this.cacheDir = options.cacheDir ?? ".turbo/cache";
-    this.daemon = options.daemon ?? true;
-    this.envMode = options.envMode ?? "strict";
-    this.runOptions = {
-      ...options.runOptions,
-      summarize: options.runOptions?.summarize ?? true,
-      concurrency: options.runOptions?.concurrency ?? 10
-    };
-    this.remoteCacheOptions = options.remoteCacheOptions;
-    this.buildAllTaskEnvVars = options.buildAllTaskEnvVars ?? {};
-    this.buildTask = new TurboRepoTask(this.project, {
-      name: ROOT_TURBO_TASK_NAME,
-      dependsOn: this.isRootProject ? [`^${ROOT_TURBO_TASK_NAME}`] : []
-    });
-    if (this.isRootProject) {
-      this.buildAllTask = this.project.tasks.addTask(ROOT_CI_TASK_NAME, {
-        description: "Root build followed by sub-project builds. Mimics the CI build process in one step."
-      });
-      this.buildAllTask.exec("turbo telemetry disable");
-      if (this.buildAllTaskEnvVars) {
-        Object.entries(this.buildAllTaskEnvVars).forEach(([name, value]) => {
-          this.addGlobalEnvVar(name, value);
-        });
-      }
-      if (!this.remoteCacheOptions) {
-        this.buildAllTask.exec(
-          `turbo ${ROOT_TURBO_TASK_NAME} ${this.renderRunArgs(false)}`
-        );
-      } else {
-        this.buildAllTask.exec(
-          `turbo ${ROOT_TURBO_TASK_NAME} ${this.renderRunArgs(true)}`,
-          {
-            condition: '[ ! -n "$CI" ]',
-            env: {
-              TURBO_ENDPOINT: `$(aws ssm get-parameter --name ${this.remoteCacheOptions.endpointParamName} --query Parameter.Value --output text --profile ${this.remoteCacheOptions.profileName})`,
-              TURBO_TOKEN: `$(aws ssm get-parameter --name ${this.remoteCacheOptions.tokenParamName} --query Parameter.Value --output text --profile ${this.remoteCacheOptions.profileName})`
-            }
-          }
-        );
-        this.buildAllTask.exec(
-          `turbo ${ROOT_TURBO_TASK_NAME} ${this.renderRunArgs(true)}`,
-          {
-            condition: '[ -n "$CI" ]',
-            env: {
-              TURBO_ENDPOINT: `$(aws ssm get-parameter --name ${this.remoteCacheOptions.endpointParamName} --query Parameter.Value --output text)`,
-              TURBO_TOKEN: `$(aws ssm get-parameter --name ${this.remoteCacheOptions.tokenParamName} --query Parameter.Value --output text)`
-            }
-          }
-        );
-      }
-    }
-    if (!this.isRootProject) {
-      this.preCompileTask = new TurboRepoTask(project, {
-        name: options.preCompileTask?.name ?? "pre-compile",
-        inputs: ["src/**"]
-      });
-      this.compileTask = new TurboRepoTask(project, {
-        name: options.compileTask?.name ?? "compile",
-        inputs: ["src/**"]
-      });
-      this.postCompileTask = new TurboRepoTask(project, {
-        name: options.postCompileTask?.name ?? "post-compile",
-        inputs: ["src/**"]
-      });
-      this.testTask = new TurboRepoTask(project, {
-        name: options.testTask?.name ?? "test"
-      });
-      this.packageTask = new TurboRepoTask(project, {
-        name: options.packageTask?.name ?? "package",
-        inputs: [".npmignore"]
-      });
-      this.tasks.push(
-        this.preCompileTask,
-        this.compileTask,
-        this.postCompileTask,
-        this.testTask,
-        this.packageTask
-      );
-    }
-  }
-  /**
-   * Static method to discovert turbo in a project.
-   */
-  static of(project) {
-    const isDefined = (c) => c instanceof _TurboRepo;
-    return project.components.find(isDefined);
-  }
-  /**
-   * Render the `turbo run` CLI flag string for the `build:all` / `reset:all`
-   * task commands from {@link runOptions}. With no `runOptions` configured the
-   * output matches the historically hard-coded flags exactly.
-   *
-   * @param remote - when `true`, also emit the remote-cache flags
-   * (`--cache=remote:rw` plus `--api` / `--token` / `--team` derived from
-   * {@link remoteCacheOptions}). The remote-cache `build:all` variant passes
-   * `true`; `reset:all` and the local `build:all` variant pass `false`.
-   */
-  renderRunArgs(remote) {
-    const run = this.runOptions;
-    const args = [];
-    if (run.summarize) {
-      args.push("--summarize");
-    }
-    args.push(`--concurrency=${run.concurrency}`);
-    if (run.force) {
-      args.push("--force");
-    }
-    if (run.noCache) {
-      args.push("--no-cache");
-    }
-    if (run.only) {
-      args.push("--only");
-    }
-    if (run.affected) {
-      args.push("--affected");
-    }
-    if (run.cacheWorkers !== void 0) {
-      args.push(`--cache-workers=${run.cacheWorkers}`);
-    }
-    if (run.continueOn !== void 0) {
-      args.push(`--continue=${run.continueOn}`);
-    }
-    if (run.frameworkInference !== void 0) {
-      args.push(`--framework-inference=${run.frameworkInference}`);
-    }
-    for (const filter of run.filter ?? []) {
-      args.push(`--filter=${filter}`);
-    }
-    if (run.outputLogs !== void 0) {
-      args.push(`--output-logs=${run.outputLogs}`);
-    }
-    if (run.logOrder !== void 0) {
-      args.push(`--log-order=${run.logOrder}`);
-    }
-    if (run.logPrefix !== void 0) {
-      args.push(`--log-prefix=${run.logPrefix}`);
-    }
-    if (run.dryRun !== void 0) {
-      args.push(`--dry-run=${run.dryRun}`);
-    }
-    const cache = run.cache ?? (remote ? "remote:rw" : void 0);
-    if (cache !== void 0) {
-      args.push(`--cache=${cache}`);
-    }
-    if (remote && this.remoteCacheOptions) {
-      args.push(
-        "--api=$TURBO_ENDPOINT",
-        "--token=$TURBO_TOKEN",
-        `--team=${this.remoteCacheOptions.teamName}`
-      );
-    }
-    if (run.additionalArgs) {
-      args.push(...run.additionalArgs);
-    }
-    return args.join(" ");
-  }
-  /**
-   * Add an env var to the global env vars for all tasks.
-   * This will also become an input for the build:all task cache at the root.
-   */
-  addGlobalEnvVar(name, value) {
-    this.buildAllTask?.env(name, value);
-    if (this.isRootProject) {
-      this.globalEnv.push(name);
-    }
-  }
-  activateBranchNameEnvVar(options) {
-    const value = '$([ -n "$GIT_BRANCH_NAME" ] && echo "$GIT_BRANCH_NAME" || git rev-parse --abbrev-ref HEAD)';
-    if (options === void 0) {
-      this.project.logger.warn(
-        "TurboRepo.activateBranchNameEnvVar() with no arguments is deprecated. It writes GIT_BRANCH_NAME to the root `globalEnv`, which forces every task in the monorepo to miss cache on every branch switch. Pass `{ tasks: [...] }` and name only the tasks that actually consume the branch (e.g. CDK synth/package) to preserve cross-branch cache hits for everything else."
-      );
-      this.addGlobalEnvVar("GIT_BRANCH_NAME", value);
-      return;
-    }
-    const knownTaskNames = this.tasks.map((task) => task.name);
-    const unknown = options.tasks.filter(
-      (name) => !knownTaskNames.includes(name)
-    );
-    if (unknown.length > 0) {
-      throw new Error(
-        `TurboRepo.activateBranchNameEnvVar: unknown task name(s) ${JSON.stringify(
-          unknown
-        )}. Known tasks on this TurboRepo: ${JSON.stringify(knownTaskNames)}.`
-      );
-    }
-    for (const name of options.tasks) {
-      const task = this.tasks.find((t) => t.name === name);
-      if (task && !task.env.includes("GIT_BRANCH_NAME")) {
-        task.env.push("GIT_BRANCH_NAME");
-      }
-    }
-  }
-  /**
-   * Paths of all generated files in the project, deduped, for use as task
-   * inputs so the compile cache invalidates when they change. Includes
-   * projen-managed `FileBase` files plus generated-once `SampleFile` /
-   * `SampleDir` — whose paths projen keeps private, so they are read defensively
-   * and skipped if that internal shape ever changes. Computed at synth time so
-   * files added after this component (e.g. a subclass's SampleFiles) are seen.
-   */
-  generatedFileInputs() {
-    const inputs = /* @__PURE__ */ new Set();
-    for (const component of this.project.components) {
-      if (component instanceof FileBase) {
-        inputs.add(component.path);
-      } else if (component instanceof SampleFile) {
-        const filePath = component.filePath;
-        if (typeof filePath === "string") {
-          inputs.add(filePath);
-        }
-      } else if (component instanceof SampleDir) {
-        const dir = component.dir;
-        if (typeof dir === "string") {
-          inputs.add(`${dir}/**`);
-        }
-      }
-    }
-    return Array.from(inputs);
-  }
-  preSynthesize() {
-    let nextDependsOn = this.project.deps.all.filter((d) => d.version === "workspace:*").map((d) => [d.name, ROOT_TURBO_TASK_NAME].join("#"));
-    if (!this.isRootProject) {
-      [
-        [this.project.preCompileTask, this.preCompileTask],
-        [this.project.compileTask, this.compileTask],
-        [this.project.postCompileTask, this.postCompileTask],
-        [this.project.testTask, this.testTask],
-        [this.project.packageTask, this.packageTask]
-      ].forEach(([pjTask, turboTask]) => {
-        if (pjTask && turboTask && pjTask.steps.length > 0) {
-          if (nextDependsOn.length > 0) {
-            turboTask.dependsOn.push(...nextDependsOn);
-          }
-          nextDependsOn = [turboTask.name];
-        } else {
-          turboTask.isActive = false;
-        }
-      });
-      this.buildTask.dependsOn.push(...nextDependsOn);
-    }
-    const generatedInputs = this.generatedFileInputs();
-    const appendGeneratedInputs = (task) => {
-      if (!task) {
-        return;
-      }
-      for (const input of generatedInputs) {
-        if (!task.inputs.includes(input)) {
-          task.inputs.push(input);
-        }
-      }
-    };
-    if (this.isRootProject) {
-      appendGeneratedInputs(this.buildTask);
-    } else {
-      appendGeneratedInputs(this.preCompileTask);
-      appendGeneratedInputs(this.compileTask);
-      appendGeneratedInputs(this.postCompileTask);
-    }
-    const fileName = "turbo.json";
-    this.project.addPackageIgnore(fileName);
-    new JsonFile(this.project, fileName, {
-      obj: {
-        extends: this.extends.length ? this.extends : void 0,
-        globalDependencies: this.isRootProject && this.globalDependencies.length ? this.globalDependencies : void 0,
-        globalEnv: this.isRootProject && this.globalEnv.length ? this.globalEnv : void 0,
-        globalPassThroughEnv: this.isRootProject && this.globalPassThroughEnv.length ? this.globalPassThroughEnv : void 0,
-        ui: this.isRootProject ? this.ui : void 0,
-        dangerouslyDisablePackageManagerCheck: this.isRootProject ? this.dangerouslyDisablePackageManagerCheck : void 0,
-        cacheDir: this.isRootProject ? this.cacheDir : void 0,
-        envMode: this.isRootProject ? this.envMode : void 0,
-        /**
-         * All tasks
-         */
-        tasks: this.tasks.filter((task) => task.isActive).reduce(
-          (acc, task) => {
-            acc[task.name] = {
-              ...task.taskConfig()
-            };
-            return acc;
-          },
-          {
-            [this.buildTask.name]: { ...this.buildTask.taskConfig() }
-          }
-        )
-      }
-    });
-    super.preSynthesize();
+// src/agent/bundles/turborepo.ts
+function renderCachingBullet(policy) {
+  if (policy.remoteCacheEnabled && policy.awsProfileName) {
+    return `- Uses remote caching (requires AWS credentials on the \`${policy.awsProfileName}\` profile)`;
   }
-};
-_TurboRepo.buildWorkflowOptions = (remoteCacheOptions) => {
+  return "- Local caching only \u2014 no remote cache is configured, so no AWS credentials are required";
+}
+function buildTurborepoBundle(buildPolicy = DEFAULT_BUILD_POLICY) {
   return {
-    env: {
-      GIT_BRANCH_NAME: "${{ github.head_ref || github.ref_name }}"
-    },
-    permissions: {
-      contents: JobPermission.WRITE,
-      idToken: JobPermission.WRITE
-    },
-    preBuildSteps: [
+    name: "turborepo",
+    description: "Turborepo workspace rules and task pipeline conventions",
+    appliesWhen: (project) => hasComponent(project, TurboRepo),
+    rules: [
       {
-        name: "AWS Creds for SSM",
-        uses: "aws-actions/configure-aws-credentials@v6",
-        with: {
-          ["role-to-assume"]: remoteCacheOptions.oidcRole,
-          ["aws-region"]: "us-east-1",
-          ["role-duration-seconds"]: "900"
-        }
+        name: "turborepo-conventions",
+        description: "Turborepo build system and task pipeline conventions",
+        scope: AGENT_RULE_SCOPE.FILE_PATTERN,
+        filePatterns: ["turbo.json", "package.json"],
+        content: [
+          "# Turborepo Conventions",
+          "",
+          "## Build System",
+          "",
+          "- **Build**: `pnpm build:all` (uses Turborepo)",
+          "- **Test**: `pnpm test` or `pnpm test:watch`",
+          "- **Lint**: `pnpm eslint`",
+          "",
+          "## Task Pipeline",
+          "",
+          renderCachingBullet(buildPolicy),
+          "- Only rebuilds changed packages",
+          "- Cache key based on file hashes and dependency graph",
+          "- Configured in `turbo.json`",
+          "",
+          "## Workspace Rules",
+          "",
+          "- Source files: `src/` directory",
+          "- Tests: Co-located with source files (`.spec.ts` or `.test.ts`)",
+          "- Exports: Use `index.ts` files for clean public APIs",
+          "- Configuration: Managed by Projen (edit `.projenrc.ts` or `projenrc/*.ts`)"
+        ].join("\n"),
+        tags: ["workflow"]
       }
-    ]
-  };
-};
-var TurboRepo = _TurboRepo;
-
-// src/agent/bundles/turborepo.ts
-var turborepoBundle = {
-  name: "turborepo",
-  description: "Turborepo workspace rules and task pipeline conventions",
-  appliesWhen: (project) => hasComponent(project, TurboRepo),
-  rules: [
-    {
-      name: "turborepo-conventions",
-      description: "Turborepo build system and task pipeline conventions",
-      scope: AGENT_RULE_SCOPE.FILE_PATTERN,
-      filePatterns: ["turbo.json", "package.json"],
-      content: [
-        "# Turborepo Conventions",
-        "",
-        "## Build System",
-        "",
-        "- **Build**: `pnpm build:all` (uses Turborepo)",
-        "- **Test**: `pnpm test` or `pnpm test:watch`",
-        "- **Lint**: `pnpm eslint`",
-        "",
-        "## Task Pipeline",
-        "",
-        "- Uses remote caching (requires AWS credentials)",
-        "- Only rebuilds changed packages",
-        "- Cache key based on file hashes and dependency graph",
-        "- Configured in `turbo.json`",
-        "",
-        "## Workspace Rules",
-        "",
-        "- Source files: `src/` directory",
-        "- Tests: Co-located with source files (`.spec.ts` or `.test.ts`)",
-        "- Exports: Use `index.ts` files for clean public APIs",
-        "- Configuration: Managed by Projen (edit `.projenrc.ts` or `projenrc/*.ts`)"
-      ].join("\n"),
-      tags: ["workflow"]
+    ],
+    claudePermissions: {
+      allow: ["Bash(npx turbo:*)"]
     }
-  ],
-  claudePermissions: {
-    allow: ["Bash(npx turbo:*)"]
-  }
-};
+  };
+}
+var turborepoBundle = buildTurborepoBundle();
 
 // src/agent/bundles/typescript.ts
 var typescriptBundle = {
@@ -32720,7 +32866,7 @@ function renderPriorityRulesSection(rules) {
 }
 
 // src/agent/bundles/index.ts
-function buildBuiltInBundles(paths = DEFAULT_AGENT_PATHS, issueDefaults = DEFAULT_RESOLVED_ISSUE_DEFAULTS, defaultAgentTier = AGENT_MODEL.BALANCED, bundleAgentTiers = /* @__PURE__ */ new Map(), prReviewPolicy = resolvePrReviewPolicy()) {
+function buildBuiltInBundles(paths = DEFAULT_AGENT_PATHS, issueDefaults = DEFAULT_RESOLVED_ISSUE_DEFAULTS, defaultAgentTier = AGENT_MODEL.BALANCED, bundleAgentTiers = /* @__PURE__ */ new Map(), prReviewPolicy = resolvePrReviewPolicy(), buildPolicy = DEFAULT_BUILD_POLICY) {
   const tierFor = (bundle) => bundleAgentTiers.get(bundle) ?? defaultAgentTier;
   return [
     buildBaseBundle(paths),
@@ -32728,11 +32874,11 @@ function buildBuiltInBundles(paths = DEFAULT_AGENT_PATHS, issueDefaults = DEFAUL
     typescriptBundle,
     vitestBundle,
     jestBundle,
-    turborepoBundle,
+    buildTurborepoBundle(buildPolicy),
     pnpmBundle,
     awsCdkBundle,
     projenBundle,
-    githubWorkflowBundle,
+    buildGithubWorkflowBundle(buildPolicy),
     slackBundle,
     buildMeetingAnalysisBundle(tierFor("meeting-analysis")),
     agendaBundle,
@@ -33817,6 +33963,13 @@ var AgentConfig = class _AgentConfig extends Component8 {
    * their rendered rule content reflects any consumer override.
    * Bundles that do not read agent paths are passed through as-is
    * from their default const exports.
+   *
+   * The build policy is auto-detected from the project's `TurboRepo`
+   * component here rather than configured, so build guidance in the
+   * `github-workflow` and `turborepo` rules only claims an AWS
+   * credential requirement when a remote cache actually exists. The
+   * getter is lazy by design — `TurboRepo` must already be attached
+   * to the project when the bundles are first read.
    */
   get pathAwareBundles() {
     if (!this.cachedBundles) {
@@ -33825,7 +33978,8 @@ var AgentConfig = class _AgentConfig extends Component8 {
         resolveIssueDefaults(this.options.issueDefaults),
         resolveDefaultAgentTier(this.options),
         resolveBundleAgentTiers(this.options),
-        resolvePrReviewPolicy(this.options.prReviewPolicy)
+        resolvePrReviewPolicy(this.options.prReviewPolicy),
+        resolveBuildPolicy(this.project)
       );
     }
     return this.cachedBundles;
@@ -40543,6 +40697,7 @@ export {
   DEFAULT_API_EXTRACTOR_REPORT_FILENAME,
   DEFAULT_API_EXTRACTOR_REPORT_FOLDER,
   DEFAULT_AUDIT_REPORT_DIR,
+  DEFAULT_BUILD_POLICY,
   DEFAULT_BUNDLE_OVERRIDES,
   DEFAULT_DECOMPOSITION_TEMPLATE,
   DEFAULT_DISPATCH_MODEL,
@@ -40663,6 +40818,7 @@ export {
   buildCompanyProfileBundle,
   buildCustomerProfileBundle,
   buildDocsSyncBundle,
+  buildGithubWorkflowBundle,
   buildIndustryDiscoveryBundle,
   buildMaintenanceAuditBundle,
   buildMeetingAnalysisBundle,
@@ -40677,6 +40833,7 @@ export {
   buildResearchPipelineBundle,
   buildSoftwareProfileBundle,
   buildStandardsResearchBundle,
+  buildTurborepoBundle,
   buildUnblockDependentsProcedure,
   bundleNameForWorkflowRule,
   businessModelsBundle,
@@ -40794,6 +40951,7 @@ export {
   resolveAgentTiers,
   resolveAstroProjectOutdir,
   resolveAwsCdkProjectOutdir,
+  resolveBuildPolicy,
   resolveBundleAgentTiers,
   resolveDefaultAgentTier,
   resolveIssueDefaults,